Meta reportedly rushed to fix a Muse 'VM escape' vulnerability before launch

Meta's AI assistant Muse reportedly needed a rushed, multi-team security push in the weeks before its launch to fix several vulnerabilities, at least one of which could have let an attacker break out of the virtual machine that runs each Muse instance, according to 404 Media. Separately, a zero-day disclosed after launch by macOS security researcher Patrick Wardle was patched by Meta, Ars Technica reported.

What's happening

404 Media reported, citing internal posts and a Meta source, that in the weeks immediately before Muse's launch, Meta engineers found several security vulnerabilities in the product. At least one of them could reportedly have let a malicious user break outside Muse's intended environment and reach Meta's own sensitive databases and services. The issues were described as severe enough that they reached CEO Mark Zuckerberg, and several teams worked nights and weekends to fix them.

In one internal post to the company's core infrastructure team on 18 September, Meta executives — including Surupa Biswas, vice president of core infrastructure, Francois Richard, vice president of engineering, and Josh Barry, senior director of engineering — wrote of "a sudden spike in reported KVM escapes, plus heightened awareness of agentic safety issues" that prompted "a service hardening push." The post said the push started on 27 August and lasted a "handful of weeks and weekends."

The term "KVM escape" refers to escaping a kernel-based virtual machine. Each Muse instance reportedly runs on its own virtual machine, which connects to — but is supposed to be isolated from — Meta's critical infrastructure. An escape is when an instance breaks out of that box to interact with the system running it, or with other users' virtual machines. 404 Media reported that several of the vulnerabilities were in the underlying Linux virtualization software Meta uses for Muse, and that at least one was related to a KVM flaw found in Linux kernel virtual-machine code in July.

A Meta source told 404 Media they felt security teams were asked to push hot fixes quickly and in a way that wouldn't delay the launch, describing what they called "half-baked protections being rushed out to enable the launch." The source also said some senior engineers believe a large data breach is inevitable as a result. Those remarks are the source's account, not a confirmed Meta statement.

Separately, Ars Technica reported on a zero-day found by Patrick Wardle. It reportedly allowed any locally installed app or terminal command — regardless of the macOS permissions it had — to gain the token that authenticates users to their Muse account, by changing an undocumented setting that controls where transcription is processed. Meta said it released a hotfix that patched the issue, more than 12 hours after Ars's report. Ars also noted that Amazon began blocking Muse from its site. This remains an evolving situation.

Who's affected

Muse users, particularly on macOS. Muse's app is macOS-only — there is no Windows version — and it can be given access to email, calendar, messaging, browsing and third-party accounts.
The people most exposed are those who granted Muse broad access to sensitive accounts and OS-level resources such as files, the microphone and camera, and location.
The pre-launch KVM escapes were internal findings about Meta's infrastructure. It is not clear that end users were affected by those specific bugs, which were reportedly addressed before launch.
On scope, 404 Media's source described a potential path from a Muse instance to Meta production and user data. Meta's bug bounty program treats a Muse virtual-machine escape as its highest-risk category, offering up to $300,000 for such a bug.

What to do

Keep the Muse app up to date. Meta said it released a hotfix for the post-launch zero-day, so staying current is the simplest precaution.
Review what you've granted Muse. Because the assistant can act with a user's privileges, only connect the accounts and OS permissions it actually needs (least privilege), and revoke access it doesn't.
No user action is known to be required for the pre-launch issues, which were reportedly fixed before launch — but that rests on Meta's account, which has not detailed the individual bugs publicly.
Watch Meta's security and safety posts and the app's release notes for updates, and treat an always-on agent with broad access as a high-value account.

Sources

404 Media — reported the pre-launch KVM escape vulnerabilities, the internal "service hardening push," and a source's account that protections were rushed to meet the launch date.
Ars Technica — reported the post-launch zero-day found by Patrick Wardle and Meta's hotfix, and that Amazon began blocking Muse.